Rules Hierarchy question

[Guest]

[m0ng0d]

I'd like ot know a bit more about the Rules Hierarchy...

For example, let's say that I made Network Control Rules that restricted access to the local network only...  An application loads and CPF pops-up for an application rule to allow/disallow internet access...

Does it matter what I say at this point for the application rule if the Network rules keep everything on the LAN?

Hopefully my question is clear

[panic]

I'd like ot know a bit more about the Rules Hierarchy...

For example, let's say that I made Network Control Rules that restricted access to the local network only...  An application loads and CPF pops-up for an application rule to allow/disallow internet access...

Does it matter what I say at this point for the application rule if the Network rules keep everything on the LAN?

Hopefully my question is clear

AFAIK: Outbound rules are applied in the following order - 1) application rules - 2) component rules and 3) network rules. Inbound, network rules are always applied first.

Someone correct me if I'm wrong.

Cheers,
Ewen :-)

[m0ng0d]

Interesting... this may be why some of my early rule attempts failed.

Is there any documentation for download?  I've glanced through the integrated help, but it appears to be more based on definitions than a HowTo.

[zorank]

I just wanted to mention that i posted similar question that was discussed under FAQ "In which order rules are applied". Perhaps you might find it helpful... /Zoran

[zorank]

Also, since we are intersted in similar things, perhaps we might collect some examples of rules setup and then try to figure what comodo exactly does with a package. What do yo think? / Zoran

[panic]

Also, since we are intersted in similar things, perhaps we might collect some examples of rules setup and then try to figure what comodo exactly does with a package. What do yo think? / Zoran

Hey Zoran/ MonGod,

It'd be fantastic if you two were to start compiling application specific rules. I asked thge others on the forum to start this, specifically for games, but there are other issues to contend with games.

There are several application specific posts already onthe forums. Search for PC Anywhere and Real VNC. I know these have been resolved, but it would be great to build up a library of application rules.

Let me know if I can help.

Cheers,
Ewen :-)

[zorank]

Ewen,

what I had in mind was a set of examples that could help beginners (like me) to understand what is really going on when packet comes in and gets out. Each example would be made of following components:

(1) specification of
   - network monitor rules
   - application monitor rules
   - no advanced stuff (since it is too much for beginners) though might be included if needed

(2) example of packet coming in

(3) description of what happens with packet step by step

We do not need that many examles, one can construct handfull of most representative ones. Also, there is no need to go into cable versus WLAN (too advanced).

In the light of what you say, one could also add real life examples for programmes that are frequently used (e-mail, we want to print in various situation, etc). Also, thinking about it, why not to make a library of examples, so that everyone can contribute. If you have a specific problem you turn to this library of examples and see if you can pick solution from there.

But, as I said, on top of this we need understanding, so few examples that show what really happens.

Zoran

[m0ng0d]

An interesting suggestion Zorank... not sure I have the knowledge or tools for packet inspection...  Not that I'd be opposed to learning however; assuming the tools are free.

[panic]

An interesting suggestion Zorank... not sure I have the knowledge or tools for packet inspection...  Not that I'd be opposed to learning however; assuming the tools are free.

There are several freeware packet sniifers out there. Do a google for "ethereal packet sniff" and "winpcap". These two utilites, used in conjunction with each other, are relatively easy to use and setup. Interpreting the info they capture and display - that's another kettle of fish! LOL

No harm in trying and it is interesting (in a very propellorhead kinda way).

Ewen :-)

[m0ng0d]

hmmm, propellors.... sounds like crossing the line between geek and nerd   

[Tags:]